06/20/200*7 WED L5: 21 FAX 7035185499 



RECEIVED 

CENTRAL FAX CENTER 

JUN 2 0 2007 



0002/012 



Application No.: 10/697,641 



Docket No.: 200309346-2 (1509-452) 



AMENDMENTS TO THE CLAIMS: 



This listing of claims will replace all prior versions and listings of claims in the 



Listing of Claims : 

1 . (Currently Amended) A method of monitoring a plurality of local event logs of a 
computer network, the method comprising: 

entering the local event logs in a central database of the computer network, and 

sending the central database from the computer network to an external support 
computer system for analysis of the entirely of the local event logs since a last 
analysis of the local event logs . 

2. (Original) The method of claim 1, wherein each local event log Is generated for 
one particular node of the computer network, and storing the local event logs in - 
the central database using a corresponding node identifier as a key. 

3. (Original) The method of claim 1, the computer network comprising a server 
computer for storing the central database, the server computer having a local 
server event log, the method further comprising storing the local server event log 
in the central database, and sending the central database from the server 
computer of the computer network to the external support computer system. 

4. (Original) The method of claim 3, further comprising entering an event into the 
local server event log after the central database has been sent to the external 
support computer system. 
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5. (Original) The method of claim 1, wherein each event log entry in a local event 
; log has an event identifier, a time stamp and event information descriptive of the 

event. 

6. (Original) The method of claim 1, wherein the central database is stored on a 
server computer of the computer network, and further comprising the steps of: 

coupling program code from the server computer to network nodes of the 
computer network, and 

transferring the local event logs of the network nodes to the server computer by 
remotely executing the program code by the server computer on the network 
nodes. 

7. (Currently Amended) A memory storing a computer program for causing a 
computer network to generate a central database for storing local event logs of 
network nodes of the computer network, the computer program causing the 
computer network to perform the steps of: 

transmitting the respective local event logs from the network nodes to a server 
computer of the computer network, 

storing the local event logs in the central database on the server computer using 
the node identifiers of the network nodes as keys for the respective local event 
logs, and 

storing a local server event log of the server computer in the central database, the 
local server event log being adapted to store a send event after the central 
database has been sent to an external support computer system for analysis of 
the local event logs; 
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wherein an entirely of the local event logs are stored since a last analysis of the 
local event logs. 

8. (Original) The memory of claim 7, wherein the program causes the network to 
send the central database to the external support computer system at 
customisable periodic time intervals. 

9. (Original) The memory of claim 7, wherein the program includes program code 
for remote execution on the network nodes to cause the network nodes to send 
the respective local event logs to the server computer. 

10. (Currently Amended) A server computer system of a computer network having 
a plurality of network nodes, the server computer system comprising: 

a controller for causing the network nodes to transmit respective local event logs 
of the network nodes to the server computer system, 

a store for the local event logs in a central database, 

a transmitter for sending the central database to an external support computer 
system for analysis of the local event logs; 

wherein an entirely of the local event loos are stored since a last analysis of the 
local event logs. 

11. (Original) The server computer system of claim 10, further comprising a local 
server event log for storing an event in response to the central database being 
sent to the external support computer system, the send event having a time 
stamp. 
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12. (Currently Amended) A discovery server comprising: 

a discovery program component for discovery of network nodes of a computer 
network, 

a remote execution program component for causing the network nodes to transmit 
respective local event logs to the discovery server, 

a central database for storing the local event logs and for storing a local discovery 
server event log, and 

an interface component for sending the central database to the external support 
computer system for analysis of the entirely the local event logs since a last 
analysis of the local event logs . 

13. (Original) The discovery server of claim 12, wherein the local discovery server 
event log is adapted to store an event indicative of a transfer of the central 
database from the discovery server to the external support computer system. 

14. (Currently Amended) A method of monitoring a plurality of local event logs, the 
method comprising the steps of: 

receiving a database from a customer computer network, the database comprising 
the local event logs of network nodes of the computer network, 

querying the database to identify a database send event in the local event logs 
and its corresponding sent time stamp, 

querying the database to identify local event log entries having time stamps later 
than the sent time stamp; 

wherein an entirely of the local event logs are stored since a last analysis of the 
local event logs. 
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15. (Original) The method of claim 14, further comprising comparing the identified 
event log entries to rules of alert policies to determine whether an alert action 
should be invoked. 

16. (Original) The method of claim 15, further comprising sending an email 
message to a response center engineer as an alert action. 

17. (Currently Amended) A memory storing a computer program for enabling a 
computer to monitor plural local event logs of a computer network, the computer 
program causing the computer to perform the steps of; 

storing a database associated with a customer computer network, the database 
comprising the local event logs of network nodes of the computer network, 

querying the database to identify a database send event in the local event logs 
and its corresponding sent time stamp, and 

querying the database to identify local event log entries having time stamps later 
than the sent time stamp; 

wherein an entirely of the local event logs are stored since a last analysis of the 
local event logs. 

18. (Original) The memory of claim 17, wherein the program causes the computer 
to determine whether an alert action should be invoked by comparing the identified 
event log entries to rules of alert policies. 

19. (Original) The memory of claim 18, wherein the program causes the computer 
to send an automatic notification to a response center engineer if the determining 
step determines an alert action should be invoked. 
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20. (Original) The memory of claim 17, wherein the computer program causes the 
computer to receive from the customer computer network the database associated 
with the customer computer network. 

21. (Currently Amended) A support computer system for providing network support 
services for a customer computer network, the support computer system 
comprising: 

a memory for storing a database associated with the customer computer network, 
the database comprising local event logs of network nodes of the customer 
computer network, 

a database query component for querying the database to determine a database 
send event and its corresponding transfer time stamp in the database and for 
querying the database to identify event log entries having time stamps later than 
the sent time stamp, 

an analysis component for comparing the Identified event log entries to the rules of 
alert policies to determine whether an alert action should be invoked; 

wherein an entirely of the local event logs are stored since a last analysis of the 
local event logs. 

22. (Original) A system according to claim 21 wherein the memory is adapted to 
receive from the customer's computer network the database associated with the 
customer computer network. 
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23. (Currently Amended) A response center computer system for providing 
network support services for a plurality of customer computer networks, the 
response center computer system comprising: 

a memory for storing a database associated with the customer computer network, 
the database comprising local event logs of network nodes of the customer 
computer network wherein an entirely of the local event logs are stored since a 
last analysis of the local event logs. 

a database query component for querying the database to determine a database 
send event and its corresponding transfer time stamp in the database and for 
querying the database to identify event log entries having time stamps later than 
the sent time stamp, 

an analysis component for comparing the identified event log entries with rules of 
alert policies to determine whether an alert action should be Invoked, and 

an automatic notification component for sending an email message to a response 
center engineer in response to the analysis component determining that an alert 
action should be invoked. 

24. (Original) A system according to claim 23 wherein the memory is adapted to 
receive from the customer's computer network the database associated with the 
customer computer network. 



25. (Neyv) The method of claim 1 comprising: 

discovering network modes of computer network, and causing the network modes 
to transmit their local event logs to be stored in the central database. 
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26. (New) The method of claim 1 ( wherein the analysis is performed using rules 
which define a set of alert policies. 



0 



9 

PACE 9/12 • RCVD AT 6Q0/2007 3:24:44 PM [Eastern Daylight Time] " SVR:USPTO-EFXRF-2/22 * ONIS:2738300 • CSID: 70351 85499* DURATION (mm-ss):04-22 



